RUSTSEC-2021-0063: XSS in `comrak`

What to do

1. See which version you have: cargo tree -i comrak (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p comrak. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example comrak = "0.10.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

comrak operates by default in a "safe" mode of operation where unsafe content, such as arbitrary raw HTML or URLs with non-standard schemes, are not permitted in the output. This is per the reference GFM implementation, cmark-gfm.

Ampersands were not being correctly escaped in link targets, making it possible to fashion unsafe URLs using schemes like data: or javascript: by entering them as HTML entities, e.g. &#x64&#x61&#x74&#x61&#x3a. The intended behaviour, demonstrated upstream, is that these should be escaped and therefore harmless, but this behaviour was broken in comrak.

References

• Package: crates.io/crates/comrak
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0063.html
• Web: github.com/kivikakk/comrak/releases/tag/0.10.1

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for comrak

• Vulnerability MediumRUSTSEC-2021-0026 · 2021-02-21XSS in `comrak`
• VulnerabilityGHSA-5r3x-p7xx-x6q5 · 2023-03-28Comrak AST node data is not validated (GHSL-2023-049)
• VulnerabilityGHSA-8hqf-xjwp-p67v · 2023-03-28Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)
• VulnerabilityGHSA-xxmq-4vph-956w · 2023-03-28Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)

Full security history of comrak